mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 13:57:22 +00:00
Add new functionality for existing ASR rule.
This commit is contained in:
parent
0c07e47939
commit
b83f8f41c3
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 05/30/2018
|
||||
ms.date: 06/12/2018
|
||||
---
|
||||
|
||||
|
||||
@ -127,6 +127,8 @@ Office apps, such as Word or Excel, will not be allowed to create child processe
|
||||
|
||||
This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables.
|
||||
|
||||
In Windows 10, version 1803 and later, this rule also blocks suspicious apps from being launched through Outlook or Access.
|
||||
|
||||
### Rule: Block Office applications from creating executable content
|
||||
|
||||
This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique.
|
||||
|
Loading…
x
Reference in New Issue
Block a user